Verify a record.
Understand its limits.

Static first

Reproduce the current reviewer case.

node verify.mjs evidence-bundle.json --pubkey ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5

Key pinning

Know which key you expect.

For this fixture

The command uses the published sample key. It differs from the live demo gateway key. The company hosts both the sample and this key; matching them is not independent authentication of the company.

For a partner's record

Obtain the expected gateway public key through a separately trusted channel. Do not use the key inside the bundle as the only authority for its own identity. The key-to-organization relationship depends on that external channel.

For a real deployment

Agree the key custodian, signing boundary, export retention and restart behavior before integration. A stable signing key does not preserve the public runtime's in-memory ledger. Export and verify before stopping it.

For command-line use

Pass a nonempty key after a space, as shown above. Do not assume all verifiers reject a missing value or support equals syntax. A plain VERIFIED result can be integrity-only; check the explicit key-match result.

Integration at a glance

What you can evaluate today.

Static artifact verification

Use the browser fixture or download the sample and standalone verifier. No agent connection is needed. AGA bundles and VerifyBundle records use different formats.

Published proxy

The agent interface is newline-delimited JSON-RPC over raw TCP. A stdio client needs a relay; a Streamable HTTP client needs a bridge. Neither is supplied. Review deployment and capture limitations before an isolated runtime evaluation.

Python recorder

Records decisions supplied by its host application. The signing key is held in that process; this is not a separately protected policy-enforcement boundary.

Private reference integrations

Go CLI, Kubernetes and Envoy work is available by arrangement. Kubernetes has not been validated end to end. Availability does not imply tested compatibility with your SDK or deployment.

Diligence questions

Read the claim behind each check.

Policy reference

Each current-case receipt commits to the included policy reference. Inspect the policy and requests beside the expected decisions. The hash alone does not establish that the policy is correct or was enforced in a deployment.

Four meanings of independence

Running a verifier outside the producer's service is different from independent authorship, a separately trusted key or an external audit. The published implementations and measurements are maintained by Attested Intelligence.

Record and outcome

The signed decision is about a tool request. It does not reveal model reasoning, establish the tool's returned result or prove the real-world action happened. Capture completeness and key-holder equivocation need controls outside the file.

Data in the export

Tool names, metadata and some denial reasons are readable. Arguments are committed by hash; values that are easy to guess may still be inferred. Review the exact fields and retention requirements before exporting sensitive activity.

Separate integration step

Read the boundary before starting a gateway.

The public reference runtime has material limitations. Use approved isolation and synthetic inputs for a bounded evaluation. These documentation links are not approval to expose a listener or handle production data.

aga-proxy 3.6.6

Evaluates covered calls against its configured policy. The default permissive profile denies nothing on policy grounds. The raw TCP listener defaults to loopback, has bounded connections and owner-bound requests, and still has no client authentication. The stdio environment excludes gateway-key variables; this does not isolate an upstream running under the same OS account. Control reads remain unauthenticated for local processes, and the ledger remains in memory. Direct bypass and key custody depend on deployment. Read current boundaries and dated affected cases.

MCP server mode

The client can invoke lifecycle and evidence tools, but this is not the same boundary as a separately isolated proxy. In 3.6.0 through 3.6.2 the governed client can re-attest its own baseline without that transition appearing in the exported bundle. Putting a seed in the client's environment does not create an independent signing boundary.

Python SDK 0.3.2

The in-process recorder signs decisions supplied by its caller; it evaluates no policy and holds the signing key in that process. An SDK export establishes record integrity, not that a separate enforcement boundary made the decision. Versions 0.2.6 and 0.3.0 were yanked for deeply nested input behavior; use the reviewed pinned version and its documented limits.

Evidence export

Retain the bundle, expected key, verifier and dependencies. The public proxy ledger is in memory and does not survive a restart. Export cost and response size have documented limits. Private Go CLI, Kubernetes and Envoy reference components are request-access work, not commands supplied by aga-verify.

Package installation can access a registry. The gateway's live default is classical Ed25519; the runtime package's hybrid library profile is not implemented by aga-verify 2.2.3. Component availability and profile scope are described separately.

Reference directory

Choose the question you need to answer.

Architecture

How the proxy binds a policy hash to a recorded decision, and how the record is verified. Public implementation and private reference components are distinguished.

Format and benchmarks

Receipt fields, verification checks, published vectors and dated primitive benchmarks. These are not end-to-end deployment performance guarantees.

Trust and scope

What a passing check establishes, what it leaves unproved, and what to retain for later verification.

Known security issues

Observed runtime, parser, key-handling and verification limitations, with affected versions and measured workarounds.

Threat model

The participants, trust boundaries and deployment assumptions behind the evidence.

Control mappings

Illustrative connections between evidence fields and framework controls. Mappings are not certification or proof that a control is satisfied.

Glossary

Definitions for governance receipts, bundles, key pinning, hash chains and Merkle proofs.

Research and legal context

Dated submissions and research materials, separated from current implementation claims. Patent status is described on the patent page.

For the pending filing, see patent status. For the broader architecture term, see Cryptographic Runtime Governance.

Test interpretation

Corpus agreement is not universal agreement.